What it means
Access ports normally assign untagged clients to a chosen VLAN. A trunk carries selected tagged VLANs between suitable switches, routers or access points. VLAN identifiers must match the planned configuration. A different Wi-Fi name does not prove that a separate VLAN exists.
How this affects everyday use
Wrong tagging, an incorrect native VLAN or missing DHCP on a segment can disconnect clients. Permissive routing can leave supposedly isolated cameras able to reach private storage.
A practical example
Cameras and office computers share a switch but belong to separate VLANs with only approved communication between them.
What to check
- Check client port assignment and trunk allowed-VLAN lists.
- Confirm each segment's addressing and DHCP service.
- Test permitted and blocked cross-segment access.
Practical next steps
- Correct tagging against the documented topology.
- Apply narrow routing and firewall permissions.
- Preserve a tested management path before changing administration VLANs.
Keeping it reliable
Back up configurations and label ports. Avoid lockout by changing remote management without recovery access. VLANs reduce broadcast scope; their security value depends on consistent enforcement across every relevant link.